Dell PowerFlex Manager
CVE-2026-22283
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable with no attacker auth but requires operator interaction and non-trivial conditions (AC:H, UI:R); description scopes impact to information disclosure only, so I and A set to N.
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Dell PowerFlex Manager, version(s) Version prior to 4.8, contain(s) an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
AnalysisAI
Information disclosure in Dell PowerFlex Manager versions prior to 4.8 stems from inclusion of functionality from an untrusted control sphere (CWE-829), allowing remote attackers to obtain sensitive data when a user is enticed into interacting with attacker-controlled content. Dell rates the issue at CVSS 7.5 with high attack complexity and required user interaction, and no public exploit identified at time of analysis.
Technical ContextAI
Dell PowerFlex Manager is the management plane for the PowerFlex software-defined storage platform (cpe:2.3:a:dell:powerflex), orchestrating block storage clusters, lifecycle operations, and integrated infrastructure. CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) covers cases where a product loads code, resources, or functionality from sources outside its trust boundary - for example, fetching scripts, libraries, or configuration from a remote location an attacker can influence. In a management console this typically manifests as loading remote content (an SDK, image, template, or external endpoint reference) without sufficient origin validation, so an attacker who can steer that load gains the ability to siphon data through the management context.
RemediationAI
Upgrade Dell PowerFlex Manager to version 4.8 or later as directed by Dell advisory DSA-2026-066 (https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities); this is the vendor-released patch and the only confirmed remediation path. Until the upgrade can be staged, restrict network access to the PowerFlex Manager UI and APIs to a dedicated management VLAN or jump-host network so the AV:N attack surface is removed, and instruct operators not to follow untrusted links or load externally supplied templates/configurations while logged into the management console - the latter directly addresses the UI:R requirement at the cost of slowing legitimate workflows that import external content. Egress filtering from PowerFlex Manager hosts to arbitrary internet destinations further constrains the untrusted-resource loading behavior characteristic of CWE-829, with the trade-off that any legitimate outbound calls (telemetry, update fetches) must be explicitly allowlisted.
Missing authentication on a critical function in Dell PowerFlex Manager allows an adjacent-network attacker to invoke pr
Authentication bypass in Dell PowerFlex Manager allows an unauthenticated attacker with adjacent-network access to gain
Improper authentication in Dell PowerFlex Manager allows unauthenticated attackers with adjacent network access to bypas
SQL injection in Dell PowerFlex Manager allows a low-privileged attacker with adjacent-network access to inject SQL comm
Privilege escalation in Dell PowerFlex Manager allows a low-privileged attacker on an adjacent network segment to bypass
Improper access control in Dell PowerFlex Manager allows a low-privileged remote attacker to trigger a denial-of-service
Dell PowerFlex Manager's improper access control (CWE-284) permits a remote, low-privileged attacker to cause a denial o
SQL injection in Dell PowerFlex Manager exposes database contents to low-privileged adjacent-network attackers via insuf
Broken or risky cryptographic algorithm use in Dell PowerFlex Manager 4.6.0.1 exposes network-accessible infrastructure
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today